Radio Frequency Identification (RFID) is a non-contact automatic identification technology which identifies a target object and obtains relevant data via a radio-frequency signal. The technology dispenses with manual intervention, is able to work under a complex environment and has the remarkable advantage that it does not require any physical contact. At present, RFID products are widely applied in fields such as retail, automatic charging, animal identification, logistics, storage, library management and the like.
The basic composition of RFID is a reader, an RFID tag and a background database (DB). Under a general circumstance, an electronic tag consists of an antenna and a tag dedicated chip. Each tag has a unique electronic code attached to the target object. The reader is a device for performing read-write operations on the tag, and mainly includes the two parts of a radio frequency module and a digital signal processing unit. The basic function of the reader is to provide a means of data transmission with the tag. The background database is mainly used for information storage, and is a database management system including data and authentication information of all tags in the system.
A tag device of the RFID system has some limitations such as limited storage space and limited calculating ability and so on. So design of an efficient, secure, and low-cost RFID security authentication method has become a new challenging problem. Current methods used to implement an RFID security mechanism mainly include a physical mechanism and a password mechanism. The physical mechanism requires addition of many physical elements and devices, which increases the cost of the tag and is not applicable to a low-cost-tag RFID system. Therefore what presented more frequently in recent RFID security research is a security mechanism based on password technology, and a design of RFID security authentication based on a Hash function is in particular under the spotlight. Current RFID security authentication based on password technology can be roughly divided into two categories: a static-ID-based mechanism and a dynamic-ID-based mechanism. The so-called “static-ID-based mechanism” method refers to that a tag ID will not be updated during authentication and remains unchanged, which method is usually used in occasions with low security demands, and cannot meet a requirement of forward security; Meanwhile, the “dynamic-ID-based mechanism” method refers to that the identification information of the tag may be updated in an authentication session, such that even if the current state of the tag is broken through, it is still impossible to conjecture a state of any previous time point or associate it with a previously obtained state. It is usually used for storing a writable tag and in occasions with high security demands, and can meet the requirement of forward security.
In a traditional authentication method, the basic model of the authentication method is as shown in FIG. 1. First the reader initiates an authentication request to the tag. The tag returns a response packet to the reader after receiving the request. After receiving the packet, the reader does not perform any operation but directly forwards the response packet to the background database, which authenticates the reader and the tag according to the response packet. If the authentication succeeds, the background database transfers the relevant information of the tag to the reader, which processes it corresponding.
A major disadvantage of the traditional method is that it presumes a strong reliability assumption. It requires a constant connection between the reader and the background database and it deems that the connection between the reader and the background database is safe. That is to say, if the reader cannot connect with the background database, neither the authentication nor corresponding operation processing can be performed. In real life, however, a truly secure channel between the reader and the background database cannot be achieved. And with the widespread application of the RFID technology to mobile devices, the real-time connection between the reader and the background database cannot be guaranteed. Moreover, the cost of keeping real-time linking will be very high, which impedes the widespread application of this technology.